Currently there are limits to how much is stored in photostream. Last 1000 photos and only (I believe) for the last 30 days.But iOS8 is coming with storing all photos automatically (like Google +, Dropbox, Kindle Fire, etc.) so it's not like this wouldn't be an issue in any cloud service.
What Apple is saying is iCloud was not broken in to and encrypted photos et al were not taken and decrypted. What they are slyly saying is the hackers figured out how to login as the celebrity through some other means and then downloaded the pics. Two completely different things.